Another Overhaul Planned for DoD's Effort to Manage Contractors' Cybe…

The US Department of Defense has suspended Phase 2 of its Cybersecurity Maturity Model Certification (CMMC) program, scheduled for November implementation, citing compliance burden concerns on small contractors. Phase 1 self-attestation requirements remain in place following November 2025 enforcement start. If you sell to the US military, the certification wall you've been preparing for just got postponed—but Phase 1 stays in force. Use the reprieve to build the compliance capability defensively; the more elaborate second phase is coming back, and buyers are still demanding it as a contract condition.